Anomaly detection vs Detection rule

Why they differ

A detection rule looks for an attack someone has already described; anomaly detection looks for anything that breaks the usual pattern.

Anomaly detection

Detection & response

Learning what normal activity looks like and raising an alarm when something departs from it, even if no rule describes the attack.

Formal

A way of finding threats by building a model of normal behaviour for users, devices or network traffic - often with machine learning - and flagging events that differ from it by more than a set amount.

In plain English

Like a bank teller who knows a regular customer so well that she notices at once when he asks to move all his savings abroad on a Sunday.

In practice

A municipal finance clerk's account, which normally opens a few files a day, suddenly copies ten thousand files one night; no rule covers this, but the model flags it and the SOC finds malware.

Why it matters

It can catch new attacks that no one has written a rule for yet, but unusual is not the same as harmful, so it brings many false alarms that people must judge.

Detection rule

Detection & response

A written condition that a monitoring tool checks against incoming logs, raising an alarm whenever the events match it.

Formal

A stored query or pattern - for example "more than ten failed logins for one account within five minutes" - that a SIEM or similar tool runs against log entries, with a priority and a short guide for the analyst attached.

In plain English

Like telling a shop guard exactly what to watch for - "anyone who tries three card terminals in a row" - instead of asking him to watch for anything strange.

In practice

After CFCS warns of a new phishing wave aimed at municipalities, a municipal SOC writes a rule that fires when any staff member's browser visits one of the web addresses in the warning.

Why it matters

Rules turn a flood of logs into a few alarms worth reading; too loose and staff drown in noise, too tight and a real attack passes unseen.

Shared connections

False positive SIEM